XSS in Nocodb
CVE-2026-24769
NocoDB is software for building databases as spreadsheets. Prior to version 0.301.0, a stored cross-site scripting (XSS) vulnerability exists in NocoDB’s attachment handling mechanism. Authenticated users can upload malicious SVG files containing embedded JavaScript, which are later rendered inline and executed in the browsers of other users who view the attachment. Because the malicious payload is stored server-side and executed under the application’s origin, successful exploitation can lead to account compromise, data exfiltration and unauthorized actions performed on behalf of affected users. Version 0.301.0 patches the issue.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (35.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 36th percentile — 35.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.000
Affected products
- Nocodb — versions < 0.301.0
Weakness classification (CWE)
References
- github.com/nocodb/nocodb/security/advisories/GHSA-q5c6-h22r-qpwr (Exploit, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-24769?
- CVE-2026-24769 is a critical-severity vulnerability in Nocodb, classified under Cross-site Scripting. CVSS score: 9.0/10. Published 2026-01-28.
- How severe is CVE-2026-24769?
- Critical severity. CVSS v3 base score is 9.0 out of 10.